PRIVACY AND DATA PROTECTION in THE BIG DATA AGE JONATHAN PRICE

“BIG DATA” “Big data is high-volume, high velocity and high-variety information assets that demand cost-effective, innovative forms of information processing for enhanced insight and decision making.” Gartner IT glossary “Big Data” is a paradigm … characterised by huge and ever increasing volumes of data being transacted over increasingly fast and broad bandwidth

“PRIVACY” Broadly interpreted: -Personal autonomy -Personal and family sphere -Includes reputation

“[T]he right to life has come to mean the right to enjoy life – the right to be let alone … Recent inventions and business methods call attention to the next step which must be taken for the protection of the person.” “The common law secures to each individual the right of determining, ordinarily, to what extent his thoughts, sentiments, and emotions shall be communicated to others … In every case, the individual is entitled to decide whether that which is his shall be given to the public.” Warren & Brandeis, 1890

Breach of confidence and professional duties Information imparted in circumstances giving rise to a duty of confidence Trade secrets Professional relationships Other obviously confidential information Necessity for a pre-existing relationship

Campbell v MGN [2004] UKHL 22 Right to privacy recognised in English law Article 8 ECHR

MPI: Elements of the cause of action 1.Is there a reasonable expectation of privacy? 2.If so, how is the balance to be struck between the individual’s right to privacy on the one hand and the publisher’s right to publish on the other?

“Too many information handlers seem to measure a man by the number of bits of storage capacity his dossier will occupy.” The Assault on Privacy: Computers, Data Banks, and Dossiers Arthur R Miller (1971)

“[t]he right of privacy has taken on new meaning in the computer age due to the highly sophisticated technology that has permeated society.” The Right of Privacy in the Computer Age Warren Freedman (1987)

Being nudged – do we have a choice? The increasing capacity for computers to influence our behaviour.

The creation of new personal data The ability of computers through machine learning to very accurately infer – that is, to be able to know – personal information about individuals from very limited and often perfectly innocent data about them that is already in the public domain.

The GENERAL DATA PROTECTION REGUALATION Announced on 25 January 2012 Seeks to: – Strengthen online data protection rights – Boost Europe’s digital economy – Update and modernise the principles enshrined in the 1995 Directive

Because: – There is a commercial need for harmonisation across the EC – 92% of Europeans are concerned about mobile apps collecting their data without their consent – 70% of Europeans are concerned about the potential use that companies may make of the information disclosed

THE RIGHT TO BE FORGOTTEN Google Spain – The processing, although carried out by Google Search which is based in a non-member state, is nevertheless carried out in the context of the activities of Google Spain, – which is established in Spain, and intended to promote and sell advertising space in Spain

Google Spain – Operator obliged in some circumstances to remove links to web pages that contain information relating to a person, – regardless of whether the publication on the third party website is lawful. – “The Court observes, furthermore, that this information potentially concerns a vast number of aspects of his private life and that, without the search engine, the information could not have been interconnected or could have been only with great difficulty.”

Google Spain – As a rule, data subject’s rights override the interest of internet users potentially interested in having access to personal information. – But there’s a balance to be struck between those rights and that interest

Google Spain Links to data should be removed if that data is or has become: – Inadequate – Irrelevant or no longer relevant – Excessive in relation to the purposes for which it was originally processed

Data protection as a ‘super-right’?